data privacy red flags